Threats tagged 'brew-gptme-cve-2026-64847'

The gptme product has a vulnerability in its use of AnyIO process-pool workers where stderr is connected to a pipe but not drained. This can cause the pipe to fill and block indefinitely if the worker writes enough data to stderr, leading to a deadlock. The issue affects versions from 0.19.1 up to but not including 0.32.1. A fix is available in version 0.32.1. Users running untrusted or faulty code that writes heavily to stderr are at risk. A workaround is to close sys.stderr in the target function to prevent deadlock.